Network Security Log Management

Logs are timestamped records of events that occur across network devices, servers, applications, and security tools. Every login attempt, firewall deny, configuration change, and file access produces a log entry. Log management is the process of collecting, storing, protecting, and analyzing those logs. Without logs, a security team investigating an attack is working completely blind.

Why Logs Are Critical for Security

Without Logs:                        With Logs:
"We were breached, but we don't      "The attacker entered at 2:14am
know when, how, or by who."          via stolen credentials for user jsmith,
                                     accessed the billing database at 2:18am,
Cannot prove anything in court.      downloaded 43,000 records, and exfiltrated
Cannot fix the vulnerability.        them to 185.100.x.x at 2:31am."
Cannot notify affected users.
Cannot meet compliance requirements. Evidence preserved. Breach timeline clear.

Types of Logs in a Network Security Context

Firewall Logs

Record every connection allowed or denied at the firewall. Show source IP, destination IP, port, protocol, action, and timestamp. Invaluable for detecting port scans, blocked attack attempts, and data exfiltration attempts.

Firewall Log Sample:
2024-03-15 02:14:01 DENY TCP 185.100.87.23:44521 → 10.0.0.5:22
2024-03-15 02:14:02 DENY TCP 185.100.87.23:44521 → 10.0.0.5:23
2024-03-15 02:14:02 DENY TCP 185.100.87.23:44521 → 10.0.0.5:80
2024-03-15 02:14:03 DENY TCP 185.100.87.23:44521 → 10.0.0.5:443
2024-03-15 02:14:03 DENY TCP 185.100.87.23:44521 → 10.0.0.5:3389

Pattern: Same external IP scanning sequential ports in milliseconds → PORT SCAN
Action:  Add 185.100.87.23 to IP blocklist, alert security team

Authentication Logs

Record every login attempt: successful logins, failed logins, password resets, account lockouts, privilege escalations. Authentication logs reveal brute force attacks, credential stuffing, unusual login times, and impossible travel (logging in from Tokyo and then London within 10 minutes).

System Logs (Syslog)

Operating system events: system starts and shutdowns, service starts and stops, hardware errors, configuration changes, software installations. System logs catch unauthorized software installation, unexpected reboots (possible malware), and configuration tampering.

Application Logs

Events generated by specific applications: web server access logs, database query logs, email server logs. Application logs reveal SQL injection attempts (unusual database queries), web scraping, unauthorized data exports, and application crashes that might indicate exploit attempts.

DNS Logs

Record every domain name lookup. DNS logs reveal malware communications to command-and-control servers, DNS tunneling data exfiltration, and attempts to reach known malicious domains.

Log Centralization

Individual devices store logs locally by default. Local logs have three problems: they disappear if the device is compromised, they cannot be correlated across devices, and they are scattered across hundreds of systems. A central log server (syslog server or SIEM) collects logs from all devices in one place.

WITHOUT CENTRALIZATION:
[Firewall logs] → stored on firewall only
[Server logs]   → stored on server only
[App logs]      → stored on app server only
Attacker compromises server → deletes server logs → evidence gone

WITH CENTRALIZATION:
[Firewall logs] ─┐
[Server logs]   ─┼──→ [ Central Log Server (SIEM) ]
[App logs]      ─┘         │
                      immutable storage
                      attacker cannot delete remotely
                      logs from all systems correlated together

Log Retention Requirements

Framework / Regulation | Minimum Retention
-----------------------|------------------
PCI DSS (payments)     | 12 months (3 months immediately accessible)
HIPAA (healthcare)     | 6 years
GDPR (EU data)         | Varies; retain as long as needed for security
SOX (financial)        | 7 years
NIST CSF               | Risk-based; typically 12 months online + archive
General best practice  | 12 months hot storage, 36 months archive

Log Integrity Protection

Logs are only useful as evidence if they have not been tampered with. Attackers who compromise a system delete or modify logs to cover their tracks. Several technical controls protect log integrity:

Protection Method          | How It Works
---------------------------|----------------------------------------------
Write-once storage         | Logs written to medium that cannot be modified
Remote log forwarding      | Logs sent to central server in real time; local copy deletion useless
Cryptographic hashing      | Each log file hashed; tamper changes the hash → detected
Append-only log servers    | Server accepts new log entries but rejects modifications
Time stamping with NTP     | All devices use synchronized time; forged timestamps inconsistent

Log Analysis — Finding the Signal in the Noise

A medium-sized organization produces hundreds of millions of log entries per day. No human can read them manually. Automated analysis finds patterns humans would miss:

Automated Log Analysis Examples:

Brute Force Detection:
→ User 'admin': 500 failed logins in 60 seconds from 1 IP
→ Alert: Brute force attack detected

Impossible Travel:
→ alice logged in from New York at 9:00am
→ alice logged in from Moscow at 9:45am (impossible to travel that fast)
→ Alert: Credential compromise suspected

Data Exfiltration Pattern:
→ Database server: 2GB of SELECT queries between 2am-3am
→ Outbound connection to unknown external IP: 1.9GB transferred
→ Alert: Potential data exfiltration

Effective log management transforms logs from compliance artifacts into operational intelligence. Organizations that invest in centralized log management, proper retention, and automated analysis detect attacks in hours rather than the industry average of over 200 days — a gap that dramatically reduces the damage an attacker can cause before being discovered.